Container

exec in a container + its group runs as an MI => execute as that MI (via IMDS/env token).

ADLS Gen2 account with public blob access enabled and a public container exposes blob data to unauthenticated internet access.

Cluster-admin kubeconfig -> exec any pod -> execute as every pod workload identity (cluster-wide summary edge; per-pod edges from container-chains cluster-rbac-exec).

Node-level code execution (privileged pod, hostPID, DaemonSet exec) reaches the node IMDS and mints a token for the node system-assigned / kubelet MI.

runCommand grants cluster-wide kubectl exec; any pod's workload identity is reachable by exec-ing into the pod (container-chains cluster-rbac-exec).

An NSG effective inbound rule allows source=Internet (or 0.0.0.0/0) with action=Allow on a specific port - the firewall is open to the public internet for that port. CONDITIONAL(network_reachability): a public IP must also be present on an attached resource for the port to be externally reachable.

An NSG effective inbound Allow rule from Internet/0.0.0.0/0 on a service port, combined with a public IP (or internet-facing LB) on an attached resource, makes that resource internet-reachable: ExposedToInternet.

A confirmed event-source binding from a Service Bus queue to a compute consumer (Azure Function serviceBusTrigger, Logic App connector, Container App KEDA scaler) - the Phase-10 binding fact.

Storage account with public blob access enabled and a public container exposes blob data to unauthenticated internet access.

Exec into a pod (cluster RBAC / credential / run-command) inherits the pod's mounted ServiceAccount/IRSA/Workload-Identity token, executing as that identity.

A VM whose source IP falls within a Filestore NFS export range can mount the share and read (and write, if READ_WRITE) all files without any IAM check - access is purely IP-address gated. CanWriteData is emitted when accessMode is READ_WRITE; CanReadData for both READ_WRITE and READ_ONLY.

Executing inside a pod on a legacy-metadata node pool (no GKE_METADATA) allows the code to call the GCE metadata server and retrieve the node pool SA's access token.

Pushing/overwriting an image in a registry poisons every workload that pulls it - code control propagates from the registry to each consuming Compute/KubernetesWorkload.

A workload poisoned via a registry image push runs as its identity, so the pusher executes as that identity.